// +build ignore

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "event.h"

// events 是一个perf buffer map，用于将数据发送到用户空间
struct {
	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
	__uint(key_size, sizeof(u32));
	__uint(value_size, sizeof(u32));
	__uint(max_entries, 1024);
} events SEC(".maps");

// BPF程序，它将被附加到 openat 系统调用的入口点
SEC("tracepoint/syscalls/sys_enter_openat")
int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx) {
	struct file_open_event event = {};
	const char *filename_ptr;

	// 从系统调用的第二个参数中读取文件名指针
    filename_ptr = (const char *)ctx->args[1];

	// 从用户空间读取文件名字符串
	bpf_probe_read_user_str(&event.filename, sizeof(event.filename), filename_ptr);

	// 将事件发送到perf buffer
	bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));

	return 0;
}

const volatile char LICENSE[] SEC("license") = "GPL";